Solana Ecosystem Bank Avici Hit by Card Contract Vulnerability, ~$500K Affected, Full Refunds Promised

On August 29, Solana ecosystem bank Avici announced that a version of the Solana card contract used by Avici and a few projects had a vulnerability. All related contracts have now been upgraded, and no further unauthorized activity has occurred. This incident only affected the standalone Solana contracts holding card balances; user self-custodied Solana and EVM wallets were not impacted. A total of 1,685 users were affected, involving approximately $500,859.22 in card balances. All affected users will receive full refunds. Avici has reported the incident to the FBI's Internet Crime Complaint Center (IC3).